The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-120213: @fastify/http-proxy: @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix9.1 CriticalN/AN/ANov 2, 2026
CVE-2026-117549: @fastify/secure-session: @fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie4.2 MediumN/AN/ANov 2, 2026
CVE-2026-117531: @fastify/multipart: @fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework5.9 MediumN/AN/ANov 2, 2026
CVE-2026-117518: @fastify/reply-from: @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server8.2 HighN/AN/ANov 2, 2026
CVE-2025-12544: WSO2: The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role…4.8 MediumN/AN/ANov 2, 2026
CVE-2024-2372: WSO2: The affected components accept user-supplied input for constructing redirection URLs without enforcing expected…5.4 MediumN/AN/ANov 2, 2026
CVE-2026-18800: WSO2: When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected…4.4 MediumN/AN/ANov 2, 2026
CVE-2026-118871: ZTE ElasticNet RNIA R18 NGI: SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL…6.5 MediumN/AN/ANov 2, 2026
CVE-2025-13647: WSO2: The affected component fails to enforce expected validation constraints on the `content-type` header when processing…5.8 MediumN/AN/ANov 2, 2026
CVE-2024-7075: WSO2: The user search function within the management console fails to properly encode user-supplied input before rendering it…4.6 MediumN/AN/ANov 2, 2026
CVE-2026-107457: Qt: A memory corruption vulnerability in the QMqttClient class of the Qt MQTT moduleN/A2.3 LowN/ANov 2, 2026
CVE-2026-18199: Zohocorp: Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an…8.8 HighN/AN/ANov 2, 2026
CVE-2026-101184: Huawei: Permission control vulnerability in the Bluetooth module5.5 MediumN/AN/ANov 2, 2026
CVE-2026-101178: Huawei: Permission control vulnerability in the autofill service module6.6 MediumN/AN/ANov 2, 2026
CVE-2026-120349: dayrui XunRuiCMS: A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.47.3 High5.5 MediumN/ANov 2, 2026
CVE-2026-101186: Huawei HarmonyOS: DoS vulnerability in the window module7.5 HighN/AN/ANov 2, 2026
CVE-2026-101185: Huawei HarmonyOS: OOB read vulnerability in the peripheral module5.9 MediumN/AN/ANov 2, 2026
CVE-2026-101183: Huawei HarmonyOS: UAF vulnerability in the location service module5.9 MediumN/AN/ANov 2, 2026
CVE-2026-101182: Huawei HarmonyOS: Race condition vulnerability in the location service module5.9 MediumN/AN/ANov 2, 2026
CVE-2026-101181: Huawei HarmonyOS: Permission control vulnerability in the WLAN module5.5 MediumN/AN/ANov 2, 2026
CVE-2026-101180: Huawei HarmonyOS: DoS vulnerability in the file parsing module4.3 MediumN/AN/ANov 2, 2026
CVE-2026-101179: Huawei HarmonyOS: Buffer overflow vulnerability in the file preview module4.7 MediumN/AN/ANov 2, 2026
CVE-2026-101177: Huawei: Permission control vulnerability in the Optimizer module3.7 LowN/AN/ANov 2, 2026
CVE-2026-101176: Huawei: Permission control vulnerability in the event notification management module7.1 HighN/AN/ANov 2, 2026
CVE-2026-101175: Huawei HarmonyOS: Null pointer dereference vulnerability in the ArkWeb module4.3 MediumN/AN/ANov 2, 2026
351-375 of 574114
‹›